17700 matches found
Workbench Moderation - Moderately critical - Access bypass - SA-CONTRIB-2018-067
The Workbench Moderation module adds arbitrary moderation states to Drupal core's "unpublished" and "published" node states, and affects the behavior of node revisions when nodes are published. In some conditions, content moderation fails to check a users access to use certain transitions, leadin...
Drupal Core - Multiple Vulnerabilities - SA-CORE-2018-006
Content moderation - Moderately critical - Access bypass - Drupal 8 In some conditions, content moderation fails to check a users access to use certain transitions, leading to an access bypass. In order to fix this issue, the following changes have been made to content moderation which may have...
PT-2018-19492
The Workbench Moderation module adds arbitrary moderation states to Drupal core's "unpublished" and "published" node states, and affects the behavior of node revisions when nodes are published. In some conditions, content moderation fails to check a users access to use certain transitions, leadin...
Search API Solr - Moderately critical - Access bypass - SA-CONTRIB-2018-065
This module provides support for creating searches using the Apache Solr search engine and the Search API Drupal module. The module doesn't sufficiently take the searched fulltext fields into account when creating a search excerpt. This can, in specific cases, lead to confidential data being leak...
Taxonomy File Tree - Moderately critical - Access bypass - SA-CONTRIB-2018-061
Taxonomy File Tree allows site managers to create file trees. For files managed as Drupal files, the module does not properly check that a user has access to a file before letting the user download the file. This vulnerability only affects sites that use private files...
DRUPAL-CONTRIB-2018-059
This module enables you to create fields for storing decimal values as two integers numerator and denominator for maximum precision. The module doesn't sufficiently filter XSS strings out of field labels. This vulnerability is mitigated by the fact that an attacker must have a role with the abili...
DRUPAL-CONTRIB-2018-057
This module enables you to build eCommerce websites and applications with Drupal. The module doesn't sufficiently check access for some of its entity types...
Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2018-057
This module enables you to build eCommerce websites and applications with Drupal. The module doesn't sufficiently check access for some of its entity types...
PT-2018-19490
This module enables you to build eCommerce websites and applications with Drupal. The module doesn't sufficiently check access for some of its entity types...
Security Bulletin: IBM API Connect is impacted by a Drupal 8 vulnerability (CVE-2018-14773)
Summary IBM API Connect has fixed the following vulnerability. API Connect is impacted by vulnerabilities addressed in the Drupal 8 advisory https://www.drupal.org/SA-CORE-2018-005 Vulnerability Details CVEID: CVE-2018-14773 DESCRIPTION: Drupal Core could allow a remote attacker to bypass securit...
CMSeeK v1.0.9 - CMS Detection And Exploitation Suite (Scan WordPress, Joomla, Drupal And 100 Other CMSs)
What is a CMS? A content management system CMS manages the creation and modification of digital content. It typically supports multiple users in a collaborative environment. Some noteable examples are: WordPress, Joomla, Drupal etc. Release History - Version 1.0.9 21-08-2018 - Version 1.0.8...
CMSeeK v1.0.7 - CMS Detection And Exploitation Suite (Scan WordPress, Joomla, Drupal And 50 Other CMSs)
What is a CMS? A content management system CMS manages the creation and modification of digital content. It typically supports multiple users in a collaborative environment. Some noteable examples are: WordPress, Joomla, Drupal etc. Release History - Version 1.0.7 07-08-2018 - Version 1.0.6...
Drupal 8.x < 8.5.6 Symfony Risky HTTP Header Restriction Bypass Vulnerability (SA-CORE-2018-005)
According to its self-reported version, the instance of Drupal running on the remote web server is 8.x prior to 8.5.6. It is, therefore, affected by a restriction bypass vulnerability in the embedded Symfony library. Note that Nessus has not tested for these issues but has instead relied only on...
DRUPAL-CONTRIB-2018-055
This module enables you to add or overwrite PHP configuration on a drupal website. The module doesn't sufficiently allow access to set these configurations, leading to arbitrary PHP configuration execution by an attacker. This vulnerability is mitigated by the fact that an attacker must have a ro...
PHP Configuration - Critical - Arbitrary PHP code execution - SA-CONTRIB-2018-055
This module enables you to add or overwrite PHP configuration on a drupal website. The module doesn't sufficiently allow access to set these configurations, leading to arbitrary PHP configuration execution by an attacker. This vulnerability is mitigated by the fact that an attacker must have a ro...
CVE-2017-6920
Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations...
Code injection
Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations...
CVE-2017-6920
Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations...
CVE-2017-6920
CVE-2017-6920 affects Drupal core 8.x before 8.3.4. Root cause: the PECL YAML parser does not safely handle PHP objects during certain operations, enabling remote code execution by an unauthenticated attacker. The provided documents do not specify exploitation vectors beyond this description, nor...
